Subject: [keyassure] more early work

From: Simon Josefsson <[email-masked]>
Date: Sat, 21 Aug 2010 09:49:26 +0200

Hi all.  I wanted to point to two more earlier work in this area:

http://tools.ietf.org/html/draft-josefsson-siked-framework-00
http://tools.ietf.org/html/draft-josefsson-pkix-dns-00

The first one contains an overview of problems and solutions around that
time and the goal was (IIRC) to do a BoF/WG at that time.  I hope things
go better this time! ;)

/Simon

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 23 Aug 2010 09:29:40 -0400

This works better than the original certain scheme. But I don't like the binding to ports. It works for tls server security but not for ws-* security and client side. 

For example, how does this work for chat and voip protocols where the port assignment is dynamic?

I don't like binding to one hash algorithm either. If you want to avoid having a dns hash field then we should use an asn1 oid in the hash field. Cert handling code can already deal with those.

One idea I had was to use the hash used in the cert signature to create a prefix tag that goes in the dns. So to declare a binding for cert fingerprint whdgchjwdgcjhdcwjhg at example.com there would be a record

_whdgchjwdgcjhdcwjhg.example.com CERT 1 9 http://repository.example.com/cert1

This approach works if you have the cert in hand when you validate. It also means that we can use the CERT field for a URL link to the repository where the cert can be pulled from.

That helps when trying to use this scheme to support a key to be used for key exchange with a dns resolver. 

Then I got started thinking about what a wildcard record would do to this. 

There has to be authentication to the right of the RR type. I would like authentication plus a URL to make the scheme fully general. 

_whdgchjwdgcjhdcwjhg.example.com CERT 1 10  whdgchjwdgcjhdcwjhg
_whdgchjwdgcjhdcwjhg.example.com CERT 1 8 http://example.com/cert1

Then in order to get binding to a specific service I would add in the srv prefix.

_whdgchjwdgcjhdcwjhg._http._tcp.example.com CERT ....

Sorry about the presentation here. This is a real &)$)&$)$& to enter on a touch screen without real copy and paste.

Sent from my iPad

On Aug 21, 2010, at 3:49 AM, Simon Josefsson <[email-masked]> wrote:

> _______________________________________________
> keyassure mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/keyassure